CVE-2026-122234

    Dashboard / Vulnerabilities / CVE-2026-122234

    CVE-2026-122234

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

    Details: jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122234.json, https://github.com/benjamine/jsondiffpatch/security/advisories/GHSA-jhmf-rq89-q58p, https://nvd.nist.gov/vuln/detail/CVE-2026-122234, https://www.vulncheck.com/advisories/jsondiffpatch-before-0.7.7-xss-via-array-move-destination-in-html-formatters, https://github.com/benjamine/jsondiffpatch/commit/c6b2d97b34bc2356c816d8dd0f8b1c8af16bb6af, https://github.com/benjamine/jsondiffpatch

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c6b2d97b34bc2356c816d8dd0f8b1c8af16bb6af

    Affected versions

    v0.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122234 | CVE-DB